Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.

Insurance Top 100 / #5ARD = Agentic Resource Discovery · A2A = Agent2Agent · MCP = Model Context Protocol

Insurance AI · commercial · Guidewire Cloud

Guidewire AI

Core insurance platform with AI/analytics for claims and underwriting workflows. Publisher: Guidewire. Also ranked in Data & Analytics (#23), Cybersecurity (#58), Healthcare & Life Sciences (#62).

Vendor page ↗+ CompareExport JSON

Trust profileas of 2026-10-26

Publisherconfirmed · Vendor-domain page, marketplace listing or metadata at publisher domain — product page served from the vendor's own domainconfirmed

Complianceno evidence about this agent · 2 vendor-level records (inherited)T5

SecurityNo CVE linked to this agent in the CVE registry — none linked in the products checked, not a findingnone

ProtocolsModel Context Protocol (MCP) probed, not foundAgent2Agent (A2A) probed, not foundAgentic Resource Discovery (ARD) probed, not found0 / 3

TracesNone found — nobody has published what this agent does under attacknone

Issues found0 regulator actions · 0 incidents · 0 withdrawn certificates · CVEs: see Securitylinks only

Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe Guidewire, not this agent specifically.

Traces — under attack, in defence, in incidents

none public · what a trace is

No public trace found. Nobody has published what Guidewire AI does when its inputs carry instructions it should not follow, when a tool asks for credentials, or when a task invites a destructive command. Defenders can't learn from what they can't see: run it in a sandbox before the pilot and keep the transcript, or ask the vendor to publish one.

● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.

CVEs — on the official record

none linked · the registry

No CVE in the registry names this agent or its listed product. That reads "none linked in the products checked", never as a finding: a product that is not on the registry's list, or a record that names it differently, is not seen. The vendor's own advisories remain the source of truth.

Compliance evidence

Jurisdiction: EU + US · 7 frameworks shown

–

SOC 2

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

–

ISO 27001

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

–

PCI DSS

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

–

ISO 42001

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

–

CSA STAR

T5 Unknown

Nothing found in the sources checked.

Scope: — · CSA STAR Registry

ask the vendor

"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.

About the vendor — inherited, not agent-specific

2 records matched at organisation level

○

GDPR · DPF active

T4 Vendor-claimed · vendor-level

Vendor-claimed

Scope: entity · vendor page · 2026-10-26

re-check 2026-11-02

○

HIPAA

T4 Vendor-claimed · vendor-level

BAA available

Scope: entity · vendor page · 2026-10-26

re-check 2026-11-02

A vendor-level registry entry proves the organisation was assessed; whether this agent is inside that scope is a question for the vendor. These rows do not count toward the agent's evidence tier.

✔ found · ○ claimed · – not found · ⚠ expired, stale or revoked. Every row links to its source.Dispute or correct this dossier

GDPR, assembled from checks

GDPR● 0 found in registries or documents○ 1 vendor-claimed⚠ 0 issues linkedas of 2026-10-26

○ ClaimedDPF active: Vendor-claimed (vendor page, 2026-10-26). Proves a transfer mechanism for EU-to-US transfers only.

– Not foundNo Article 42 GDPR seal. "GDPR certified" is never shown without one.

☐ You checkYour lawful basis, DPIA, and whether this agent is inside the certificate scope.

News and chatter

last 90 days · linked with confidence ≥ 0.85

Nothing linked from Hacker News, GDELT, GitHub releases or the vendor's feed in the last 90 days.

Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.

Insurance score

69

regulated profile · sar-score-2.0 · #5 of 100 in the curated list

Adoption / usage25 / 30

Trust & security19 / 25

Project / product health20 / 20

Ecosystem / interoperability13 / 15

Domain expertise / fit72 / 100

Governance / compliance evidence3 / 100

Docs / transparency9 / 10

Raw component / maximum, then weighted by the regulated profile (adoption 15, trust 25, project 10, ecosystem 10, domain 20, governance 15, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.

Before you deploy

Deployment questions answered from the vendor's documentation, each with its source.

?Masks or minimises personal data before it reaches the model? Not documented — The trust page lists certifications (SOC 1/2 Type 2, ISO 27001, ISO 27701, PCI DSS) and makes no statement about AI features source

?Data residency or regional hosting documented? Not documented — Not mentioned on the trust page source

?Customer data excluded from model training (documented)? Not documented — Not mentioned; only a general commitment to process data "as contractually permitted" source

?Human review before a decision or record change is executed? Not documented — Not mentioned on the trust page source

?Audit log of agent actions documented? Not documented — Not mentioned on the trust page source

Evidence supporting this use (2)

GDPR DPF active — vendor-claimed, vendor-level source

HIPAA — vendor-claimed, vendor-level source

Unknowns to check (10)

Masks or minimises personal data before it reaches the model: not documented — The trust page lists certifications (SOC 1/2 Type 2, ISO 27001, ISO 27701, PCI DSS) and makes no statement about AI features. Ask the vendor. source

Data residency or regional hosting documented: not documented — Not mentioned on the trust page. Ask the vendor. source

Customer data excluded from model training (documented): not documented — Not mentioned; only a general commitment to process data "as contractually permitted". Ask the vendor. source

Human review before a decision or record change is executed: not documented — Not mentioned on the trust page. Ask the vendor. source

Audit log of agent actions documented: not documented — Not mentioned on the trust page. Ask the vendor. source

Your lawful basis and DPIA for PHI and personal data the agent will touch

That the HIPAA BAA is offered for this product tier and region

The transfer mechanism you will rely on; DPF covers EU-to-US transfers only

Ask the vendor for SOC 2, ISO 27001, PCI DSS, ISO 42001, CSA STAR evidence; none was found in the sources checked

Whether the agent exposes MCP or A2A endpoints; none were observed

Suggested restrictions for a pilot (7)

Keep PHI and PII out of pilot inputs, or apply your own redaction before the agent sees a record.

Confirm in contract that customer data is excluded from model training before the pilot starts.

Keep the agent advisory: no automated claim decisions or system writes during the pilot.

Log inputs and outputs on your side; the vendor's audit trail is not documented.

Confirm the processing region in writing before personal data of EU or UK residents is in scope.

Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked.

No public trace of this agent under adversarial input was found. Run it in a sandbox against your own prompt-injection and tool-abuse scenarios before the pilot, and keep the transcript; the enterprise edition records one.

See the worked comparison: Claims and document-intake agents that touch personal data →

Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.

Provenance

seed workbookscores, rank, category

vendor pageclaims

NVDsecurity (CVE keyword search)

Hacker News, GDELT, vendor feedsnews and chatter

First seen2026-10-26

Recordres_f59a653440ffe6e3

Open the full record (JSON) →